Best Risk Strategy for an Unpatchable Critical Legacy System?
A security analyst discovers several vulnerabilities on a critical legacy system. The analyst must recommend a solution with the following limitations: • No downtime is permitted due to criticality. • Patches for the vulnerabilities do not exist. • No redundancy systems are in place. Which of the following is the best risk management strategy to implement?
Community Insight
The exam tests whether you can separate mitigation via compensating controls from acceptance when a patch is unavailable; the trap is concluding that an unpatchable flaw can only be accepted.
This scenario tests risk response selection when a critical legacy system cannot be patched, taken down, or failed over. The page establishes that mitigation through compensating controls is the best strategy, not acceptance or transference.
Choosing acceptance (D) because no patch exists, ignoring that segmentation, WAF/IPS filtering, access restrictions, and monitoring can still reduce risk.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Mitigation is the best fit for all three constraints because it reduces risk without requiring a patch, downtime, or redundant systems. Compensating controls such as network segmentation, WAF/IPS filtering, tighter access restrictions, and enhanced monitoring can lower the likelihood or impact of exploitation on the legacy system. The critical system can remain online while its exposure is reduced to a more acceptable residual level. This is the core risk-management distinction the question is testing: an unpatchable vulnerability does not automatically mean the only response is acceptance.Why the Other Options Are Wrong
Transference shifts financial or contractual consequences, for example through cyber insurance or outsourcing, but it does not remove the vulnerability from the critical legacy system. Avoidance would mean stopping the business activity or decommissioning the system, which conflicts with the no-downtime and criticality constraints. Acceptance means formally living with the risk without applying further controls, which is premature when feasible compensating controls exist. Acceptance may describe the residual risk after mitigation, but it is not the best primary strategy here.Community Comment Notes
rocco82 supports mitigation and points to firewalls, segmentation, and WAF as practical controls. rvln7 makes the strongest case for B, noting that "the risk can still be reduced through compensating controls" even without a patch, and correctly warns that treating acceptance as doing nothing is too passive when technical controls exist. Pochex argues for acceptance because the vulnerability remains, but that reasoning confuses residual risk with the absence of mitigation; insurance or outsourcing would still leave the flaw in place. The community split reflects the intended trap: the vulnerability cannot be eliminated, but it can still be mitigated.Official Reference
Exam Strategy
When a question blocks patching or downtime, look for answers that still reduce likelihood or impact; compensating controls point to mitigation. Do not default to acceptance unless every feasible control is exhausted and the risk is formally approved.
Frequently Asked Questions
Why isn't acceptance the right answer for an unpatchable legacy system?
Acceptance is a last resort when no feasible control exists; here segmentation, WAF/IPS, access restrictions, and monitoring can still reduce risk, so mitigation is preferred.
Can cyber insurance or outsourcing replace mitigation for this legacy system?
No. Transference shifts financial impact but leaves the vulnerability in place; the organization still needs compensating controls to reduce the risk.